{
  "family": "pynamer",
  "sample_count": 67,
  "category": "trojan",
  "description": "Pynamer (cataloged across security vendors and threat intelligence databases under signatures including Trojan:Win32/Pynamer, Trojan.Pynamer, and Trojan:Win32/Pynamer!ac) is a versatile family of compiled Python trojans active since 2018. Packaged into standalone Windows Portable Executables using utilities like PyInstaller, cx_Freeze, or Py2exe, Pynamer encapsulates complete Python runtime environments and obfuscated bytecode to evade conventional static antivirus signatures. In the wild, Pynamer is distributed via malicious cracked software installers, game cheat tools, and malicious email attachments. Upon execution, the malware extracts its internal Python payload into %Temp%, establishes persistent autostart registry entries under Windows CurrentVersion\\Run, and initiates encrypted C2 communications. Pynamer acts as an initial access stager, capable of capturing keystrokes, harvesting browser credentials, downloading secondary malicious payloads, and providing interactive backdoor shells.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Trojan:Win32/Pynamer",
    "Trojan.Pynamer",
    "Trojan:Win32/Pynamer!ac",
    "Win32/Pynamer"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Trojan:Win32/Pynamer?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Pynamer is a compiled Python trojan packaged as an executable that steals credentials and downloads malware."
      }
    },
    {
      "@type": "Question",
      "name": "How is Pynamer packaged to evade antivirus scanners?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It uses Python compilation tools like PyInstaller to bundle obfuscated bytecode inside standalone binaries."
      }
    },
    {
      "@type": "Question",
      "name": "What malicious capabilities does Pynamer possess?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It logs keystrokes, steals stored browser passwords, executes remote commands, and downloads secondary payloads."
      }
    },
    {
      "@type": "Question",
      "name": "How does Pynamer maintain persistence across Windows reboots?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It writes autostart entries to the Windows CurrentVersion\\Run registry key."
      }
    },
    {
      "@type": "Question",
      "name": "How can systems be disinfected from Pynamer?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Quarantine the infected binary with antimalware software, clear %Temp% extraction folders, and remove startup registry keys."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1027",
    "T1059.006",
    "T1547.001",
    "T1105",
    "T1555.003",
    "T1082",
    "T1071.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1027.002",
      "name": "Obfuscated Files or Information: Software Packing",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1059.006",
      "name": "Command and Scripting Interpreter: Python",
      "tactic": "Execution"
    },
    {
      "id": "T1129",
      "name": "Shared Modules",
      "tactic": "Execution"
    },
    {
      "id": "T1027",
      "name": "Obfuscated Files or Information",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1566.001",
      "name": "Phishing: Spearphishing Attachment",
      "tactic": "Initial Access"
    }
  ],
  "containment_steps": [
    "Quarantine the endpoint to halt the execution of the unpacked Python payload, which could be an infostealer or ransomware.",
    "Clear the Windows `%Temp%` directory, specifically looking for and deleting any `_MEIxxxxxx` folders created by the PyInstaller stub.",
    "Submit the original massive executable to a malware analyst for unpacking and decompilation to understand the specific threat.",
    "Perform a full system sweep to determine the initial delivery vector (e.g., a phishing email or a compromised download)."
  ],
  "what_to_avoid": [
    "Do not waste time trying to statically analyze the original `.exe` file using standard dissassemblers; you must unpack the Python bytecode first.",
    "Avoid assuming the threat is contained just by deleting the `.exe`; the script may have already executed and established persistence elsewhere."
  ],
  "target_industries": [
    "Healthcare",
    "Critical Infrastructure",
    "Enterprise"
  ],
  "motivation": "Credential Theft & Unauthorized Access",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "defense_evasion",
    "impact"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "first_seen": 2018,
  "threat_actor": null,
  "delivery_mechanism": [
    "Cracked Software & Keygens",
    "Video Game Cheat Packages",
    "Phishing Email Attachments"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7"
  ],
  "capabilities": [
    "Compiled Python Bytecode Execution",
    "Keystroke Logging",
    "Browser Password Harvesting",
    "Secondary Payload Downloading",
    "Registry Autostart Persistence"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable (PyInstaller)",
      "Python Bytecode (.pyc)",
      "Dynamic Link Library (DLL)"
    ],
    "network_signatures": [
      "HTTP POST beacons sending JSON-formatted credential logs to C2 servers",
      "HTTPS requests downloading encrypted payload archives"
    ],
    "evasion_techniques": [
      "Packaging inside legitimate PyInstaller runtime wrappers",
      "Dynamic runtime bytecode decryption"
    ],
    "persistence_mechanisms": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\PynamerClient",
      "%AppData%\\PythonService\\pynamer.exe"
    ]
  },
  "impact": {
    "confidentiality": "High",
    "integrity": "High",
    "availability": "Medium",
    "scope": "Browser credential compromise, personal keystroke monitoring, secondary payload deployment"
  },
  "lineage": {
    "derived_from": [
      "Python-Based Information Stealers"
    ],
    "variants": [
      "Pynamer.A",
      "Pynamer.AC"
    ]
  },
  "iocs": {
    "file_hashes": [
      "1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e",
      "2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f"
    ],
    "delivery": [
      "cheat_installer.exe",
      "pynamer_setup.exe"
    ],
    "persistence": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\PythonUpdater",
      "%Temp%\\_MEI\\pynamer_core.exe"
    ]
  },
  "sources": [
    {
      "name": "Microsoft Defender Security Intelligence - Trojan:Win32/Pynamer",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Pynamer"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - Trojan.Win32.Pynamer",
      "url": "https://www.trendmicro.com"
    }
  ]
}